Tomographic Quantum Cryptography 
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We present a protocol for quantum cryptography in which the data obtained for mismatched 
bases are used in full for the purpose of quantum state tomography. Eavesdropping on the quantum 
channel is seriously impeded by requiring that the outcome of the tomography is consistent with 
unbiased noise in the channel. We study the incoherent eavesdropping attacks that are still permis- 
sible and establish under which conditions a secure cryptographic key can be generated. The whole 
analysis is carried out for channels that transmit quantum systems of any finite dimension. 
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I. INTRODUCTION 

The objective of quantum cryptography is the distri- 
bution of a secure cryptographic key between two parties, 
traditionally called Alice and Bob. The key consists of 
a truly random sequence of "letters." The most impor- 
tant among the schemes proposed for this purpose — the 
BB84 protocol of Bennett and Brassard and Ekert's 
E91 protocol J3— and all experimentally realized schemes 
(Refs. 0, 0, HjS 0i m particular, but also others), use 
a binary alphabet, i.e., just two letters that are usually 
denoted by the numbers and 1. A very readable ac- 
count of the state of this art is the recent review article 
by Gisin et al. @. 

Binary keys suffice, of course, for all practical pur- 
poses and they are relatively easily generated with the 
aid of qubits (binary quantum alternatives). In fact, the 
selected experiments cited above provide increasing ev- 
idence that it may be commercially viable to introduce 
feasible quantum cryptographic systems in the near fu- 
ture. 

The utter simplicity of the kinematics of a qubit, 
the most elementary quantum degree of freedom, facil- 
itates both the theoretical analysis and the experimen- 
tal implementations. And yet, there is a natural curios- 
ity about schemes for quantum cryptography that ex- 
ploit richer degrees of freedom, especially qutrits (ternary 
quantum alternatives, for three- letter keys), and gener- 
ally qunits (n-fold quantum alternatives, for n-letter keys 
with n= 2,3,4,... ). 

Almost all qunit schemes are generalizations of the fa- 
miliar BB84 and E91 qubit protocols [1 ITol fill IT^ . and 
we deal with a particular generalization of E91 in the 
present paper. It is worth mentioning, however, that 
there is also at least one higher-dimensional scheme of 
quite a different kind, namely the deterministic protocol 
of Beige et al. [l3f. in which four-dimensional systems 
(pairs of qubits, for instance) are used for the generation 
of a binary key. 

The BB84 and E91 protocols are mdeterministic be- 
cause key letters are only obtained when Alice's and 
Bob's measurement bases match and, therefore, a sub- 



stantial fraction of the data is not used at all (in BB84) 
or just for security checks (in E91). In the protocol we an- 
alyze here, all measurement results for mismatched bases 
are exploited for complete quantum state tomography, by 
which Alice and Bob manage to impose very stringent 
conditions on the quantum channel and so limit eaves- 
dropper Eve's possibilities substantially. 

The paper is organized as follows. In Sec.[n]the stage 
is set by defining the tomographic protocol. Then we 
analyze, in Sec. IIIII what the eavesdropper can do and 
achieve, which prepares the subsequent determination of 
the security criterion in Sec. IIVI We close with a sum- 
mary of our results and a critical discussion of some cru- 
cial details. 



II. THE TOMOGRAPHIC PROTOCOL 

We consider a setup of the kind sketched in Fig. ^ A 
source emits entangled pairs of qunits to Alice and Bob, 
who receive one qunit each of every pair. The qunits dis- 
tributed by the source in this manner constitute an ef- 
fective quantum channel between Alice and Bob (A&B), 
although these two users are not themselves sending any 
quantum systems to each other. As a consequence of un- 
avoidable imperfections, both in the functioning of the 
source and in the transmission line, this quantum chan- 
nel will be noisy to some extent, so that A&B will not 
receive qunit pairs with the ideal properties they hope 
for. 

Nevertheless, they will be able to generate a secure 
cryptographic key if the noise level is below a certain 
threshold. But to be on the safe side, they must de- 
termine this threshold level under the assumption that 
all imperfections result from their adversary Eve's inter- 
vention, who eavesdrops on the communication between 
A&B. In particular, one must grant Eve full control over 
the qunit-pair source, and she will try to know as much 
about the qunits detected by A&B, as the laws of physics 
allow her to know. 

After receiving a qunit from the source, Alice measures 
a non-degenerate observable that she selects at random 
from her set of n + 1 tomographically complete observ- 



2 



Eve controls the source: 
She prepares pairs of entangled qunits 
- each pair additionally entangled with an ancilla - 
and sends one qunit of each pair to Alice, the other to Bob 




Alice measures the m'th 
of her n + 1 observables 
and gets the ktb 
measurement result 



Bob measures the mth 
of his n + 1 observables 
and gets the Zth 
measurement result 



v — pJ ass ic aj _ c h an n e \___y ' 

FIG. 1: Schematic setup of the key distribution system. Alice 
and Bob are connected to each other by an effective quantum 
channel, which consists of a source that distributes entangled 
qunit pairs. For each qunit, Alice measures one of her tomo- 
graphically complete observables, chosen at random when the 
qunit arrives. Bob does the same for each of his qunits. They 
exchange well chosen information about their measurements 
through a classical channel, and conclude then whether or not 
the quantum channel has the right characteristics to allow for 
the generation of a secure cryptographic key from their raw 
data. In their security analysis, Alice and Bob assume that 
all imperfections of the quantum channel result from eaves- 
dropper Eve's intervention and, to be on the safe side, they 
grant Eve full control of the source. 



qunits through a public channel. They can then divide 
the detected qunit pairs into two groups, one in which 
the measurement bases match (both m values are the 
same, which happens with a probability of l/(n+ 1) ), 
and one in which the bases do not match. In the ab- 
sence of noise, the measurement results of the first group 
(the respective k values — referred to as nit values) are 
perfectly correlated and thus give rise to a cryptographic 
key in an alphabet with n letters. 

In reality, however, A&B must take into account Eve's 
attempts at eavesdropping and the resulting disturbance 
of the quantum channel. As a consequence thereof, the 
statistical properties of the detected qunit pairs will not 
be correctly described by the pure two-qunit state of J2J. 
Rather than the projector k/')('^ > an appropriate statis- 
tical operator p applies to the qunit pairs emitted by a 
non-ideal source. 

Since A&B measure tomographically complete sets of 
observables on their respective qunits, they can deter- 
mine the actual two-qunit state p from their measure- 
ment results. They exploit all data of the mismatched 
bases for this purpose, and some of the matched-bases 
data. Ideally, they wish for the projector |V , )(' ! /'| but, 
realistically, they expect to find a p of the form 



p = (A-j8i)|V><V'| + — with /? + (n-l)p\ = l, (3) 



ables 0, ^3 . She keeps a private record of the observ- 
ables she measures and of the outcomes of her measure- 
ments. Likewise, Bob measures on each of his qunits an 
observable randomly chosen from his corresponding set, 
and keeps a record of his data as well. We adopt the 
notation of |2(j and denote by 
Alice's mth observable and by 
Bob's mth observable. The correspondence between the 
two sets of observables, or rather between the orthonor- 
mal measurement bases they provide, is then established 
by requiring that 



m,fc) the kth. eigenket of 
mfe) the fcth eigenket of 



(Oj\m k ) = (m k \0j) 



(1) 



holds for j, k — 0, 1, 2, . . . , n — 1 and m = 0, 1, 2, . . . , n. 
In short, the roles of bras and kets are interchanged. 

Ideally, A&B wish to receive from the source the max- 
imally entangled two-qunit state that is specified by 



n-l 



n-l 



v fc=0 v k=0 

^ n— 1 

= ^tEK^)- ( 2 ) 



k=0 



As a consequence of it has the same form regardless 
of the pair of observables that is used to define it. 

When the transmission is over, A&B announce their 
choice of observables, their respective m values, for all 



which is what one gets when an imperfect transmission 
line admixes unbiased noise to The non-negative 

parameters (3q and p\ have the following physical signif- 
icance: f3o is the probability that Alice and Bob get the 
same nit value when the bases match, and p\ is the prob- 
ability that Bob gets a particular one of the n — 1 values 
that are different from Alice's nit value. 

Formally, p is a non-negative operator of unit trace, 
and thus permissible as a statistical operator, whenever 
< p\/p\) < n/(n— 1). But only values in the range 



o<^<: 

Po 



(4) 



correspond to an admixture of symmetric noise to |^(^>| 
and, therefore, this is the parameter range of interest. 
The limiting values mark the extreme situations of "no 
noise at all" (po = 1, f3\ = 0) and "nothing but noise" 
(A, =Px = l/n). 

Sources that emit two-qunit states of a kind different 
from @ are not regarded as trustworthy by Alice and 
Bob. As the crucial, defining step of the tomographic 
protocol, they thus accept the raw key sequence only if 
their state tomography confirms that the source emits a 
two-qunit state of the form @. Otherwise, they reject 
the data wholly and use a different source. 
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III. EAVESDROPPING 



and 



A. Choosing the right ancilla states 

By imposing this rather stringent requirement, A&B 
restrict Eve's possibilities markedly. Her strategy is to 
keep a quantum record of what she sends to A&B by 
entangling each qunit pair with an ancilla, and to perform 
a judiciously chosen measurement on the ancilla after 
carefully weighing the information exchanged by A&B 
through the public channel. Quite generally, Eve's option 
is to prepare an entangled pure state of the form 



I*) 



n-l 

Ei 

k,l=0 



m k mi 



(any m = 0, 1, . . . , n), 



(5) 

where the | Ejj,; ) 's are the unnormalized kets of the an- 
cilla states attached by Eve (with reference to the mth 
pair of A&B's observables). Since there is no advantage 
in generating a mixed state instead, it is sufficient to con- 
sider all such pure-state preparations. 

Now, the two-qunit state received by A&B is obtained 
by tracing over the ancilla degree of freedom, and 

their insistence on getting p of ® implies that Eve must 
choose her ancilla states such that they obey 



Po — Pi j j- 0i j- . 

OklOk'l' H Okk'Oll' 

n n 



0o/n ]fk = l = k' = I', 
Pxjn if k = k'^l = l', 
{00 - Pi)/n if * = I j= k' = I', 
otherwise. 



(6) 



The right-hand side does not depend on the to value to 
which the ancilla states on the left refer and, therefore, 



the mapping |E^) — ► |E^ n is unitary. Quite explic- 
itly, two different sets of ancilla states are related to each 
other by 



Tj*(ro')\ 



E feD = 



k'V 



^v){ m k\m' k ,){m' v \mi), (7) 



which is an immediate consequence of 10 and 1(1)1. As 
a check of consistency, one can exploit the completeness 
and orthonormality of the single-qunit states \rrik) to ver- 
ify rather easily that 10 holds for any to value, if it holds 
for one of them. In summary, then, it does not matter 
which to value Eve chooses in (jSJ). 

It is expedient to introduce normalized ancilla states 



E^) in accordance with 



k = I 
k ^ I 



) = 

eD = 



^VPoJr 



Then 



(Eif |E$>=< 1 



1 if k = k' and I = V, 
0x100 iik = l^k' = V, 
otherwise, 



(8) 



(9) 




I*) 



~El mfcmi )l E fc™ ) ) (any m = 0, . . . ,n). 

k^l 

(10) 

As stated in ©, for each to value, the ancilla states 
|Ejy ) with k 7^ I are orthogonal to each other and or- 
thogonal to the ones with k — I. The latter are not 
orthogonal among themselves (except when Pi = Po, the 
case of pure noise and of very little interest), but rather 
have the same inner products for all pairs, 



Pi 

Po 



(11) 



EJ.T') are thus linearly independent, 



The n ancilla states |E^™ 
except when Pi = 0, which is the ideal situation of no 
noise at all, that is no eavesdropping (2~ 



B. Ancilla subspaces 

This exception aside, the k = I ancilla states |E^^) 
span a n-dimensional subspace that is orthogonal to 
the (n 2 — n)-dimensional subspace spanned by the k ^ I 
states. We refer to them as the first and the second sub- 
space, respectively. The subspaces associated with dif- 
ferent to values are related to each other by the unitary 
transformations of (7J|. 

Eve takes advantage of the structure of these subspaces 
in the eavesdropping attack that we now proceed to de- 
scribe. We shall deal solely with attacks, in which she 
performs measurements on the ancillas one-by-one, com- 
monly termed incoherent attacks. By contrast, in a co- 
herent attack, she would measure some joint observables 
of a few, or perhaps many, ancillas j2^| • This limitation 
is mainly dictated by the technical difficulties that one 
faces when analyzing coherent attacks. We note, how- 
ever, that some have argued — notably Cirac and Gisin 
|2flj . and Wang j^3| — that coherent attacks are not more 
powerful than incoherent attacks, but their arguments re- 
fer rather explicitly to protocols of the BB84 type, with 
intercept-resend eavesdropping attacks, and are not im- 
mediately applicable to our tomographic qunit protocol. 

Eve's incoherent eavesdropping procedure is as follows. 
The information exchanged by A&B over the classical 
channel identifies those qunit pairs that contribute to the 
raw key sequence, the ones for which Alice's to value is 
the same as Bob's. To find out, as much as she can, 
about the nit values that A&B have recorded for each 
of these matched qunit pairs, Eve performs a suitably 
chosen measurement on the respective ancillas, one at a 
time. The statistical operator for one of these ancillas 
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is obtained by tracing I^V^I 
freedom, with the outcome 



over the qunit degrees of 



(« 
Pe- 



_ Po 



— y^|E lm, )(E (m, | + — 

fe=0 



,(m) 



(m)| 
fefc 



E 



E 



(to) 
fcZ 



><Eir }| 



(12) 



where to identifies the matched pair of bases. The first 
summation corresponds to the situation, in which A&B 
get the same nit value and the ancilla ends up in the 
first subspace, which happens with probability /3q. And 
the situation of differing nit values, when the final an- 
cilla state is in the second subspace, is accounted for by 
the second summation, which carries the complementary 
weight of (n — = 1 — /3q. 

Since the various pj^'s (to = 0, 1, . . . ,ri) are unitarily 
equivalent, it is sufficiently general to consider just one 
to value. For notational simplicity, we leave it implicit 
from here on and suppress the to label. Then we have 



= /? p (=) + (1 - 



with 



n-l 



fe=0 



and 



„ (n 3i)El E «>< E «l 



(13) 



(14) 



(15) 



The first of these conditional statistical operators, p^ = \ 
applies when A&B have the same nit value and the sec- 
ond, applies when they don't. Since p^ and 
reside in the first and second subspace, respectively, Eve 
can discriminate between the two situations unambigu- 
ously. 

Suppose she thus establishes that different nit values 
are the case. Under this circumstance, she performs a 
measurement that distinguishes between the k ^ I ancilla 
states, which is surely possible because they are mutually 
orthogonal. She finds the ancilla in the state with ket 
Efcd)j say, and then knows with certainty that Alice's nit 
value is k, and Bob's is I (with k ^ I, of course). 

By contrast, if Eve establishes that the nit values of 
A&B are the same, she cannot find out with certainty 
what is this common value because the k = I ancilla 
states are not orthogonal to each other, except when the 
(3i = (3q limit is reached in Q and the right-hand side 
vanishes in i|ll|) . 

For Pi < /?o, Eve's attempts in discerning the non- 
orthogonal lEfcfc) ancilla states in the first subspace are 
prone to error. Recalling (|1 1|) . we note that the inner 
product for each pair of them is the same positive num- 
ber, just like it is for the vectors pointing from the tip 
of a pyramid to the corners at its base. It is known 
that the error-minimizing measurement for such "pyra- 
mid states" is the so-called square-root measurement (see, 



e.g., 1.3 ll l.32» and the pertinent references therein, in par- 
ticular |33|| and |34^- Although demonstrating this op- 
timality requires a careful argument, it is easy to grasp 
the basic idea of a square-root measurement. 



C. Square-root measurement 

For the following, up to and including <|27[) . we restrict 
the discussion to the first subspace. Then the n kets 



|efcfc) — 



|Efc/c) 



decompose the identity by construction, 
^|efefc)(e fefe | = 1, 



(16) 



(17) 



and thus define a generalized measurement — the square- 
root measurement. Now note the eigenvalue equations 



(p M -ro)J2\ E n) =0 > ( 18a ) 



( P H - n) 



with 



r = l 



n - 1 p x 



n p 



so that 

r + (n — l)n = 1 



1 & 
r - n = 1 - — 

Po 



(18b) 



(19) 



(20) 



The eigenvalue ro is nondegenerate, whereas n is (n — 1)- 
fold, and not n-fold, because the n kets in l|18bj) have 
a vanishing sum. We make use of these eigenvalues in 
writing 



1 



ro + v^on + r\ - p ( ~> 



and then exploit Ijl8(l to establish 

1 - \fr~iJr~Q 



(21) 



jEfefe) 



EI E «) • ( 22 ) 



The parameters r]o and r\\ that appear in the probabil- 
ity amplitudes 



(efcfe|E«) = y/rjo&kl + v^i(l _ f>kl) 



(23) 



are crucial, inasmuch as they quantify Eve's knowledge 
about the common nit value of A&B: Upon finding |efcfe), 
she knows that the actual nit value is k with probability 
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t]q and that it is either one of the n—1 other values with 
probability r\\. In conjunction with i|2U[l . the required 
normalization 

m + (n- l)m = 1 (24) 
follows immediately from the explicit expressions 



r + (n-l)^/n y/ro-y/n 
Va = ~ 7= — , yfm = — 



The implied identity 



(25) 



(26) 



is worth noting. 

We close the discussion of the square-root measure- 
ment in the first subspace with the observation that Eve's 
reference states \ekk) are orthonormal, 



(efcfc|e«) 



(27) 



As a consequence, the generalized measurement defined 
by the decomposition l|17[) is in fact a standard von Neu- 
mann measurement. 

Now returning to the general discussion of the full sta- 
tistical operator iJTSJ, we summarize Eve's strategy as 
follows. She performs a measurement that distinguishes 
the n 2 states 1351 



|efcz) 



as given m 



for k 



\E M ) for k + I, 



(28) 



which are orthonormal. With probability (n — l)/?x = 
1 — 0o she finds a state with k ^ I, and then infers that 
Alice's nit value is k, and Bob's is I. And when Eve finds 
a k = I state, which happens with probability /3o, she 
knows that A&B have the same nit value and can guess 
it right with probability 770, but will guess a particular 
one of the n—1 wrong values with probability 171 . 



D. Probabilities 

In more formal terms, the joint probability that, for 
matched bases, Alice gets nit value k, Bob gets I, and 
Eve detects \ef-'i>) is given by 



Pki-k'i' = |(E fc i|e fc 'i')| = —SkiS k 'i'[{vo-m)Skk' + m] 

+ — (l-6 kl )6 kk ,5 w . (29) 



All reduced and conditional probabilities are derived 
from this expression by partial summation and normal- 
ization. For later reference we note the joint probabilities 
for Alice and Bob, 



Pk 



it &B) = E Pw*'!' = ~ [(#> " + h] , (30) 



and for Alice and Eve, 

p£k>v ] = J2 p ki-,k'i' = -rh'v [(vo - m)$kk> + m] 



+-<W(i-<W), (31) 



as well as the individual probabilities for Alice and Bob, 



(A) _ V"^ 1 (B) _ V"^ 1 

Pk — Pkl;k'l' — — 1 Pi — 2-^i Pkl;k'l' — ~ 1 

(32) 

and for Eve, 

p k E l = Y,Pkw - i [0* - + a] • ( 33 ) 

k,l 

To get a first rough understanding of the significance 
of A&B's probabilities (3q, /?i and Eve's conditional prob- 
abilities rjo,r]i, consider this scenario. A qunit pair has 
been received by A&B and detected with matched bases. 
Both Bob and Eve are asked to bet on Alice's nit value. 
Bob's best strategy is to guess that Alice's value agrees 
with his own, and he guesses right with probability /?o, 
but he is never sure about Alice's nit value. Eve, by 
contrast, knows Alice's nit value with certainty when de- 
tecting the ancilla in one of the k ^ I states of l|28ll . 
and guesses right with probability rjo otherwise. Her to- 
tal betting odds are thus 1 — (3q + /?o?7o- The comparison 
with Bob's establishes that, if such bets are performed 
frequently, 



Bob wins more often if /3 > (n + 3)/3i, 
Eve wins more often if /3q < (n + 3)/3i, 
and they come out even if (3q = (n + 3)/3i . 



(34) 



These betting odds are, however, really only a rough mea- 
sure of Bob's and Eve's knowledge about Alice's nit value, 
because Eve's information is qualitatively different from 
Bob's. As discussed in the next section, the ratio 
must be substantially below the l/(n + 3) threshold of 
(|34|l if A&B want to be able to generate a secure key 
from the raw key sequence that these bets are about. 



IV. SECURITY CRITERION 

A. Csiszar-Korner threshold 

A more systematic quantitative measure of what Bob 
and Eve know about Alice's nit values is the mutual in- 
formation between the respective parties. With the prob- 
abilities of (|3l]|l and lO, we get 



/(A&B) = 5>!f B > log. 



k.l 



Pkl 
(A) (B) 

P k Pi 



k'V 



l + A)log n /? + (l-A))log n /?i (35) 
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v 




FIG. 2: The difference v, denned in 1371 . of the mutual in- 
formation between Alice and Bob and between Eve and ei- 
ther one of them, as a function of /So, for various values of 
n. Curves a-e are for n — 2,3, 5, 10, and 100, respectively. 
A secure key can be generated from the raw key sequence if 
v is positive. The threshold value of f3o, the point of inter- 
section with the v = line, decreases with increasing n and 
approaches f3o = § for n — > oo. 



for the mutual information between Alice and Bob, 
where, fitting to the n-letter alphabet, the logarithm is 
taken to base n. Likewise, the mutual information be- 
tween Alice (or Bob) and Eve is given by 



/(A&E) 



k,k',l 



(A&E) , 
Pk-k'l' iogr, 



„(A&E) 
l J k:k'V 
(A) (E) 
Pk Pk'V 



= 1 

Their difference 



A) [m log„ Vo + 0-- Vo) lo &n m] ■ (36) 



v = /(A&B) - /(A&E) 
= A) log„ A) + C 1 - A) log„ Ai 

-A) iog n % + (i - iog n ml 



(37) 



is shown in Fig. [2] for n = 2,3,5,10, and 100 over the 
A) range of (@J. There, it is a monotonically increasing 
function of A that grows from v = — 1 for A) = l/ n to 
v = 1 for A = 1- The values of A> where the sign of 
t/ changes, are listed in Table [I] for some n, along with 
the corresponding values of nA/A) an d the ratio 771/770 
of Eve's conditional probabilities. 

Now, according to the Csiszar-Korner (CK) Theo- 
rem [36j, a secure cryptographic key can be generated 
from the raw key sequence, by means of a suitably chosen 
error correcting code and classical (one-way) communi- 
cation between Alice and Bob, if the mutual information 
between Alice and Bob exceeds that between Eve and 
either of them. In the present context, this is to say that 
the tomographic protocol is secure (under the incoherent 
eavesdropping attacks considered) if v > 0. Moreover, v 
is then the yield of the key generation, in the sense that 



TABLE I: Threshold values of some parameters. For the var- 
ious n values of the first column, the table reports values of 
/3o, n/3i/A)> an d Vi/vo for which the CK threshold is reached 
(v = 0), or for which the CK yield is 50% (v = §). The 
limiting values for n — * oo are shown in the last row. 
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v = 






v = 0.5 




A 


nBi 18a 


77i /Tin 


A 




?7i fun 

'IX 1 '/U 


2 


0.8436 


0.3707 


0.2659 


0.9357 


0.1373 


0.4661 


3 


0.7733 


0.4398 


0.2741 


0.9050 


0.1574 


0.4649 


4 


0.7334 


0.4846 


0.2790 


0.8870 


0.1698 


0.4641 


5 


0.7077 


0.5163 


0.2821 


0.8750 


0.1785 


0.4635 


10 


0.6503 


0.5975 


0.2880 


0.8468 


0.2010 


0.4604 


30 


0.6016 


0.6851 


0.2887 


0.8203 


0.2266 


0.4532 


50 


0.5881 


0.7146 


0.2872 


0.8123 


0.2358 


0.4496 


100 


0.5747 


0.7475 


0.2843 


0.8040 


0.2462 


0.4448 


oo 


0.5 


1 


0.25 


0.75 


0.3333 


0.4019 



a secure key of length vL can be obtained from a raw 
key sequence of length L. This invites to call max{0, v} 
the CK yield. It is positive when A) is larger than the 
threshold values of Table|Uand vanishes at and below the 
threshold. 

Any actual implementation of the tomographic proto- 
col for quantum key distribution needs a reasonable effi- 
ciency. The v = threshold is then of less interest than, 
say, the v — | threshold at which the CK yield reaches 
50%. The respective values of A), nfli/Po, and m/^o are 
also listed in Table [I] 

For sufficiently large n, the threshold values of A) are 
well approximated by 



A) 



l 



2 + log 



l±u 



(38) 



which becomes the strikingly simple A) ~ 5(1 + l°Sn 2) 
for v = 0. By comparing with the entries in the second 
and fifth columns of Table HJ we observe that the error is 
1% or less for v = and n > 4, or v — | and n > 3. For 
v = 0, 0.3, 0.6, and 0.9, we illustrate (JSHJ in Fig. El 



B. Channel capacities 

It is interesting to view the CK security criterion also 
from another perspective of information theory. Rather 
than mutual information, the relevant notion is then that 
of channel capacity. 

The generation of the raw key can be regarded as 
the outcome of a communication between Alice and Bob 
through the effective quantum channel of Fig. By 
choosing her observables and measuring them, Alice ef- 
fectively prepares the qunits sent to Bob in the states 
resulting from the formal procedure of state reduction. 
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FIG. 3: Threshold values of f3 for CK yields of 0%, 30%, 60%, 
and 90%. As a function of n, with the abscissa linear in log n, 
the crosses display the exact values of /3q for which v = 
(set a), v = 0.3 (set b), v = 0.6 (set c), or v = 0.9 (set d), 
respectively. The solid lines show the corresponding values of 
the analytical approximation 138H . which is assuredly good for 
large n values, but performs remarkably well even for small 
ones. 

For instance, after Alice has measured her mth observ- 
able and found \rrik) for her qunit, her reduced statistical 
operator for Bob's qunit is 

pf' m) = Wo - 0i)\mk)(m k \ + Pi , (39) 

with each k value occurring — or, now, being sent — with 
probability 1/n. Upon measuring his mth observable, 
Bob gets the nit value k with probability (3q and each of 
the n— 1 other ones with probability /3 1; quite consistent, 
of course, with the joint probabilities (|30|l . 

These projective measurements carried out by Bob can 
be interpreted as his attempt to extract the information 

encoded by Alice in the states p^ ,m \ so that, for every 
m, a certain quantum channel is thus defined between 
Alice and Bob. Since, for a given m, Bob gets all right 
nit values with the same probability Po/n, and all wrong 
values with the same probability Pi/n, we are in fact 
dealing with a so-called weakly symmetric channel |37|. 
For a channel of this kind, transmission at full capacity 
is achieved for totally random input, as is the case here. 

All m values are equivalent, and the capacity of each 
channel, C*(A&B) = 1 + p log n p + (1 - p )log n P 1 , 
is just equal to the mutual information /(A&B) of 
[38| . A similar reasoning applies to the effective ancilla 
channel between Alice and Eve that is associated with 
Eve's square root measurement. The capacity C(A&E) 
of this channel is also equal to the corresponding mutual 
information, /(A&E) of 

It follows that the CK threshold criterion for the tomo- 
graphic protocol has a simple intuitive meaning: secure 
one-way communication is possible if the capacity of the 
channel between Alice and Bob is higher than the capac- 
ity of the channel between Alice and Eve. 



V. SUMMARY AND DISCUSSION 

The protocol for quantum key distribution that is de- 
scribed and analyzed in this paper differs from other pro- 
tocols by the element of complete quantum state tomog- 
raphy. For this purpose, Alice and Bob exploit the mea- 
surement results they obtain for unmatched bases, rather 
than just discarding these data as one does in the BB84 
protocol and its various generalizations. The check for a 
violation of Bell's inequality in the E91 protocol amounts 
to a partial state tomography and, in this sense, our to- 
mographic protocol might be viewed as a refinement and 
generalization of the E91 protocol. 

In the tomographic protocol, Alice and Bob insist on 
the source emitting entangled two-qunit states of a par- 
ticular form — only states from a one-parametric family 
are in fact regarded as acceptable — and thereby they 
limit Eve's choice of eavesdropping attacks stringently. 
Up to unitary equivalence, there is then only one prepa- 
ration by Eve of the qunit pairs, entangled with her an- 
cilla states, that gives her best knowledge of the raw key 
sequence obtained by Alice and Bob. But even with this 
optimized eavesdropping attack, Eve does not acquire 
enough information to prevent Alice and Bob from gen- 
erating a secure key, provided that the two-qunit state 
is in the parameter range where the Csiszar-Korner the- 
orem applies. Alice and Bob find out whether this is 
the case when they determine the parameters of the two- 
qunit state by state tomography. 

But the story does not end here. If the source emits 
states outside the parameter regime where an immediate 
key generation is possible, Alice and Bob might still be 
able to achieve their objective although it seems that Eve 
knows too much. They just need to first "distill" a better 
raw key, for which purpose they can choose between the 
quantum procedure of entanglement distillation 1391 |4 dl 
and the classical procedure of advantage distillation |4lj| . 
Recent work establishes ^3 that both procedures are ap- 
plicable if Po > 2/3i and only then, which is, therefore, the 
true threshold condition for the tomographic protocol. 

The square-root measurement, on which the present 
analysis of Eve's incoherent attack is based (and also the 
analysis in Q^), maximizes Eve's odds of guessing Alice's 
nit values right but, as noted by Shor [43, it does not 
always maximize her information about them. In other 
words, it may happen that a (slightly) larger value of the 
mutual information between Alice and Eve obtains for 
another measurement. The only case on record for which 
this is known to occur is, however, a very flat n = 3 pyra- 
mid of states, outside the physical parameter range of Q). 
Other cases are likely to exist, possibly also for larger n 
values and rather tall pyramids. If so, the CK threshold 
values would be changed (slightly), but presently there is 
no indication that the Po > 2/3i condition for successful 
distillation is affected. These matters are not settled as 
yet, systematic investigations are being performed, and 
results will be reported in due course. 

In protocols of the BB84 type, Alice prepares qunits 
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and sends them to Bob, with Eve eavesdropping on the 
quantum channel. As discussed in Sec. llV Bl one method 
of preparation could be to detect one qunit of an entan- 
gled pair, thereby reducing the state of the other, which 
is on its way to Bob. In the setup of Fig. ^ this would 
amount to having, so to say, the source inside Alice's lab- 
oratory. It follows that our analysis has a bearing also 
on schemes of the BB84 type. Reversing the argument, 
no matter how Alice prepares the qunit sent to Bob, she 
can treat her record of it as if it were the result of a 
measurement on another qunit, be it real or virtual. Al- 
ice and Bob can then treat their joint records as if the 
data referred to entangled qunit pairs, and apply the to- 
mographic protocol. In effect, this limits Eve's choice 
of eavesdropping attacks on the quantum channel in an 
analogous way and, as a consequence, our results are also 
applicable to tomographic protocols of this other kind. 

In the security analysis of protocols of BB84 type, Eve 
is assumed to intercept the qunits in transmission, to use 
some cloning device for copying the qunit state with the 
fidelity permitted by quantum limitations, and to per- 
form eventually a suitable measurement on the quantum 



copy. It is in this context of single-qunit protocols that 
relations equivalent to 1251) were first derived for qutrits 
(ri = 3) by Brufi and Macchiavello 0,0], and conjec- 
tured to hold for arbitrary n Also, the (3q > 2(3% 
threshold condition for both distillation procedures ap- 
plies to BB84-type qunit protocols |45l lia ] . And for the 
question about the optimality of Eve's square-root mea- 
surement in the tomographic protocol, there is an analo- 
gous question about the optimal cloning device in single- 
qunit protocols. In view of these close interrelations, a 
definite answer to one of them will surely teach us a les- 
son about the other question, too. 
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